1. Mobile Security for QlikView
June 2011

2. Common misconceptions about iPad/iPhone security
They’re not as secure as Blackberry
Data on the device is not secure
They are easily ‘jailbroken’
Data protection doesn’t exist
It’s easy to hack into the data stream over WiFi or 3G
There is no support for VPN
They don’t support existing IT security infrastructures
There’s no support for Digital Certificates, SSL, SSO
There is no central management capability
No remote data wipe
No integration with MS Exchange ActiveSync

3. QlikView Mobile: Security
QlikView on iPad is a highly secure environment for deploying Business Discovery solutions
There are three principle aspects to understand when
approaching mobile security
Device & Data Security
Transmission Security
QlikView native Security

4. QlikView Mobile: Security
Device and Data Security
iPad supports the following device-level protection
Strong Password enforcement
Local and over-the-air password enforcement
RSA keyfob support
Password retry limit
Local wipe capability on limit exceeded
Device (hardware) encryption
256-bit AES encryption
Data Protection API’s
Over-the-air remote wipe/kill capability
Uses Exchange ActiveSync
Encrypted iTunes backups
QlikView for iPad does not cache or store data locally on the device. It uses a browser-based AJAX interface

5. QlikView Mobile: Security
Transmission Security
iPad supports the following secure communication methods
VPN
iPad has built-in CISCO IPSec, L2TP and PPTP support
SSL/TLS
WPA/WPA2
128-bit AES encryption
Digital Certificates
X.509 with RSA keys

6. QlikView Mobile: Security
QlikView native Security
QlikView integrates with existing SSO and LDAP
solutions
Perimeter authentication via AD & other SSO solutions
HTTP headers, Ticketing
Multi-tiered approach to deployment security
Firewalled back end/front end
QlikView Server handles user authorization
Integrates with existing LDAP for group resolution

7. Typical Laptop security vs iPad security
Strong alphanumeric password enforcement
Centralized management
Password retry limit
Hardware-level data encryption
VPN support
Digital Certificate support
Open USB ports?
Easily removable harddrive?
Local file and application structure
Strong alphanumeric password enforcement
Centralized management
Password retry limit
Hardware-level data encryption
VPN support
Digital Certificate support
Open USB ports?
Easily removable harddrive?
Local file and application structure

8. Typical Blackberry security vs iPad/iPhone security
Strong alphanumeric password enforcement
Centralized management
Password retry limit
Hardware-level data encryption
VPN support
Digital Certificate support
BES
Communications logging
Regulatory compliance
Auto ‘push’ of policy updates
FIPS data encryption
Strong alphanumeric password enforcement
Centralized management
Password retry limit
Hardware-level data encryption
VPN support
Digital Certificate support
No BES equivalent for logging
Auto ‘push’ of updates through ActiveSync
AES 256-bit encryption
FIPS at ‘Test’ stage of certification

9. Does any of this impact QlikView on iPad?
In short: NO
Why?
QlikView for iPad does not store data on the device
All questions about FIPS encryption are irrelevant
FIPS is an extremely aggressive policy, used only by Governments/Military and some Financial Services institutions
Logging of all mobile activity is usually only mandated by high-security environments like Govt/Military and some Fin Svcs
QlikView Server will still log all activity to QlikView files

10. Common misconceptions about iPad/iPhone security
They’re not as secure as Blackberry
At the very highest levels, no. But for almost all organizations’ needs, this is false
Data on the device is not secure: False
They are easily ‘jailbroken’: Irrelevant: Data Protection API’s
Data protection doesn’t exist: False: 256bit encryption; Data Protection API’s
It’s easy to hack into the data stream over WiFi or 3G: False
There is no support for VPN: False. CISCO VPN with iOS4
They don’t support existing IT security infrastructures: False
There’s no support for Digital Certificates, SSL, SSO: False
There is no central management capability: False. iPhone Configuration Utility permits this
No remote data wipe: False. ActiveSync allows this
No integration with MS Exchange ActiveSync: False

11. Summary
There are have no worries proposing the QlikView for iPad solution when it comes to enterprise security!!

12. QlikView Mobile: Security
Apple and QlikTech have a range of documents covering Mobile Security
iPad Security Overview.pdf
iPad Enterprise Deployment Guide.pdf
iPad Deployment Scenarios.pdf
QlikView Security Overview White Paper
QlikView Development and Deployment Tech Brief

13. iPad Implementation Example
Security requirements:
Apply user certificate on iPad to authenticate the user on the mobile device
Provide second authentication against active directory
Authorize the QV document to the authenticated users
Technical Details:
QVS 10 SR2
Windows 2003
IIS 6, Safari
User certificates on iPads for the users in PKCS#12 format along with certificate chain
User certificates installed on the iPad using IPCU tool from Apple
HTTP/SSL with tunneling enabled

14. iPad User Certificate
A digital certificate is composed of a public and private key pair, along with other information about the user and the certificate authority that issued the certificate
Certificates for the users in PKCS#12 format along with certificate chain
Certificates are installed on the iPad using IPCU tool from Apple
iPad profiles are signed and encrypted
iPad profiles can not be used except with the assigned iPad
Users are not able to remove profile unless they have the administrative password
Certificates should not exceed 1024 bit encryption and need to be in RSA algorithm
Microsoft public key certification authority (CA) is used to request user certificates. A CA is a service that issues and manages electronic credentials or certificates in a public key infrastructure (PKI)

15. User Certificate Setup Details
Configure IIS
Setup one to one mapping for user certificates on the IIS server. This provides IIS server with the authorize access to intended users only.
Client certificate is used to authenticate the user. IIS website should already have a SSL certificate.
Here are two scenarios for this configuration:
IIS Server is not in domain
ISS server is either in DMZ network or in Public domain.
Creating a user account on the IIS server. This user is a local user on the IIS (QVUser).
All certificate mapping is done against this local user account and then Qlikview application requests for active directory user name and password to authenticate users on the application.
IIS Server is part of domain
Authenticating users is done against local server using one local account and certificate is mapped to the local account

16. How is the user authenticated with a certificate?
User iPad has the certificate which is issued by the internal CA.
This user certificate has one public key and one private key. To prove the identity of the user, user need private key on the client side. Web server will validate the certificate submitted by the client and then allow access to this user
In case we want to remove access for application for any user, we need to remove the certificate map which we established on the IIS server
Certificate map name plays an important role as the user certificate based is identified based on certificate map name and not the local account

17. Second Authentication
Provide basic authentication against Active Directory
How?
Configure IIS security
Necessary step to disable “Windows Integrated Security” as we want to authenticate the users not through IIS but by using QV code authenticate.aspx
Enable “Anonymous Authentication” for the “QvAjaxZfc” and “QVClients” folder. Make sure that the username and password are valid.
Modify authentication file
Modify authenticate.aspx to get the end user prompted for username and password and to authenticate the user against the active directory.
This is the second step on achieving double authentication.
* Refer to “How to achieve double authentication on iPad with Safari” technical paper

18. How does the solution work?
Because of the one to one mapping and certificates applied on the 2nd IIS web server, when the user tries to open QV application URL from a desktop or from a mobile device that does not have user certificate, they see this page:

19. How does the solution work?
The user connects to the IIS site and IIS requests for user certificate which is already created on iPad. User is prompted for certificate and submits its public key to the IIS server. Considering user has the correct certificate and IIS recognizes this certificate, then IIS encrypts the contents using user public key and sends back to the user. As user has both of the keys, user decrypts the contents sent by IIS using own private key and starts communication with the IIS server.
The next step is the second authentication. User gets prompted for the username and password to get authenticated against the active directory.
The final step in the process is to give the authenticated user access to the authorized documents.

20. Thank You Q&A